Image Credit: Shutterstock
- Mercado Bitcoin suspended deposits and withdrawals following a security breach on November 2.
- Blockchain researcher Bitquery estimated that approximately $48.5 million in transfers occurred during the incident.
- Mercado Bitcoin later reported that it had blocked $11.2 million in assets.
Mercado Bitcoin suspended deposits and withdrawals on Nov. 2 after a security breach, with blockchain researcher Bitquery tracing approximately $48.5 million in transfers. The exchange later reported $11.2 million in blocked assets, and it would also protect customer holdings.
Exchange Pauses Transfers During Investigation
Mercado Bitcoin had identified and quickly contained an incident affecting one of its systems. It suspended deposits and withdrawals as a precaution and stated that its teams were investigating and coordinating with authorities.
The Brazilian exchange initially noted that the customers had suffered no losses and no data had leaked. It also published destination addresses associated with the transfers to help others monitor the funds across Ethereum-compatible networks, Bitcoin, Solana, Stellar and TRON.
Company Reports $11.2 Million Blocked
In a later statement of CNN Brasil, Mercado Bitcoin stated that $11.2 million in assets had been blocked. It named Tether, Circle, BRL1, Paxos and Chainalysis among the organizations supporting its response.
CNN Brasil also reported the exchange’s estimate of approximately $38 million still involved in the incident, without explaining how that figure reconciled with the blocked assets or independent transfer estimates. Blocking assets restricts their movement but does not itself mean they have been returned to the exchange.
Mercado Bitcoin had identified additional assets that could be blocked and would announce a reopening timetable through official channels.
The company also warned that it does not request passwords, verification codes or recovery phrases, or offer reimbursements through unsolicited links, WhatsApp messages or calls.
Bitquery Finds Transfers From Deposit Addresses
Bitquery estimated that $48.5 million left exchange-associated wallets across ten blockchains, valued when the transfers occurred. Ethereum accounted for approximately $29.5 million, the largest portion of its estimate.
The researcher also identified 35,853 Ethereum customer deposit addresses that sent assets to the attacker, worth approximately $261,000 collectively. These addresses are used to fund exchange accounts; their count does not establish how many individual customers were affected.
Those transfers continued for more than two hours after Mercado Bitcoin’s initial containment statement. Bitquery could not determine whether the attacker obtained private keys or access to a system authorized to approve transfers.
